引导意识：从内部检测激活引导
Steering Awareness: Detecting Activation Steering from Within
AI总结：
研究探讨模型能否检测内部引导向量，通过微调七种指令调优模型，在测试概念上实现高检测率和概念识别率，揭示引导引导并非安全评估中的隐形干预。
摘要：
激活引导——通过向模型残差流添加向量来修改其行为——在安全评估中被广泛使用，如同模型无法检测干预。我们检验这一假设，引入引导意识：模型在自身前向传递过程中推断是否存在引导向量及其编码的概念。微调后，七种指令调优模型在测试概念上发展出强引导意识；最佳模型在干净输入上达到95.5%的检测率、71.2%的概念识别率和零误报。这种能力可泛化至未见的引导向量构造方法，当其方向与训练分布有高余弦相似性时，表明是一种几何检测器而非通用异常检测器。令人惊讶的是，检测并不带来抗性；在事实和安全基准上，检测训练的模型在引导方面比基础模型更易受攻击。机理上，引导意识并非源于局部电路，而是源于分布式转换，逐步将不同注入向量旋转到共享的检测方向。因此，激活引导不应被视为安全评估中的隐形干预。
英文摘要：
Activation steering -- adding a vector to a model's residual stream to modify its behavior -- is widely used in safety evaluations as if the model cannot detect the intervention. We test this assumption, introducing steering awareness: a model's ability to infer, during its own forward pass, that a steering vector was injected and what concept it encodes. After fine-tuning, seven instruction-tuned models develop strong steering awareness on held-out concepts; the best reaches 95.5% detection, 71.2% concept identification, and zero false positives on clean inputs. This generalizes to unseen steering vector construction methods when their directions have high cosine similarity to the training distribution but not otherwise, indicating a geometric detector rather than a generic anomaly detector. Surprisingly, detection does not confer resistance; on both factual and safety benchmarks, detection-trained models are consistently more susceptible to steering than their base counterparts. Mechanistically, steering awareness arises not from a localized circuit, but from a distributed transformation that progressively rotates diverse injected vectors into a shared detection direction. Activation steering should therefore not be considered an invisible intervention in safety evaluations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
